Machine learning models with multi-budget differential privacy

Abstract

Various examples are directed to systems and methods for using a machine learning model. A computing system may access training data comprising a plurality of training data items. Each of the plurality of training data items may comprise a plurality of features. From a first training data item of the plurality of training data items, the computing system may generate a first transformed training data item using a first privacy budget corresponding to a first portion of the first training data item and a second privacy budget corresponding to a second portion of the first training data item. The computing system may train a machine learning model using the first transformed training data item and use the trained machine learning model to generate at least one class probability for a data item.

What is claimed is: 
     
         1 . A computing system, comprising:
 at least one processor programmed to perform operations comprising:   accessing training data, the training data comprising a plurality of training data items, each of the plurality of training data items comprising a plurality of features;   from a first training data item of the plurality of training data items, generating a first transformed training data item using a first privacy budget corresponding to a first portion of the first training data item and a second privacy budget corresponding to a second portion of the first training data item;   training a machine learning model using the first transformed training data item to generate a trained machine learning model;   applying the trained machine learning model to the training data to generate at least one class probability for the plurality of training data items;   applying the trained machine learning model to test data comprising a plurality of test data items to generate at least one class probability for the plurality of test data items;   training an adversary machine learning model using training data, the at least one class probability for the plurality of training data items, the test data, and the at least one class probability for the plurality of test data items;   using the adversary machine learning model to determine a training data membership loss;   using the adversary machine learning model to determine a test data membership loss; and   using the training data membership loss and the test data membership loss to update at least one weight of the adversary machine learning model.   
     
     
         2 . The computing system of  claim 1 , the operations further comprising:
 selecting a first noise level for a first feature of the first training data item using the first privacy budget;   applying the first noise level to the first feature of the first training data item;   selecting a second noise level for a second feature of the first training data item using the second privacy budget; and   applying the second noise level to the second feature of the first training data item.   
     
     
         3 . The computing system of  claim 2 , the operations further comprising generating a second transformed training data item from a second training data item of the plurality of training data items, the generating of the second transformed training data item comprising:
 applying the first noise level to a first feature of the second training data item; and   applying the second noise level to a second feature of the second training data item.   
     
     
         4 . The computing system of  claim 1 , the operations further comprising:
 applying an encoder model to the first training data item to generate a first set of latent variable values, the first set of latent variable values comprising a first latent variable value and a second latent variable value;   selecting a first noise level for the first latent variable value using the first privacy budget;   applying the first noise level to first latent variable value;   selecting a second noise level for the second latent variable value using the second privacy budget;   applying the second noise level to the second latent variable value; and   applying a decoder model to generate the first transformed training data item.   
     
     
         5 . The computing system of  claim 1 , the operations further comprising applying a feature importance tool to the machine learning model to determine a first importance value for a first feature of the plurality of features and a second importance value for a second feature of the plurality of features. 
     
     
         6 . The computing system of  claim 5 , the operations further comprising:
 accessing sensitivity data describing at least a first sensitivity level for the first feature and a second sensitivity value for the second feature; and   using the sensitivity data and the first importance value for the first feature to determine a modified first feature privacy budget.   
     
     
         7 . The computing system of  claim 5 , the operations further comprising:
 sending the first importance value for the first feature to a user computing device; and   receiving, from the user computing device, an indication of modified first feature privacy budget.   
     
     
         8 . A computer-implemented method, comprising:
 accessing training data, the training data comprising a plurality of training data items, each of the plurality of training data items comprising a plurality of features;   from a first training data item of the plurality of training data items, generating a first transformed training data item using a first privacy budget corresponding to a first portion of the first training data item and a second privacy budget corresponding to a second portion of the first training data item;   training a machine learning model using the first transformed training data item to generate a trained machine learning model;   applying the trained machine learning model to the training data to generate at least one class probability for the plurality of training data items;   applying the trained machine learning model to test data comprising a plurality of test data items to generate at least one class probability for the plurality of test data items;   training an adversary machine learning model using training data, the at least one class probability for the plurality of training data items, the test data, and the at least one class probability for the plurality of test data items;   using the adversary machine learning model to determine a training data membership loss;   using the adversary machine learning model to determine a test data membership loss; and   using the training data membership loss and the test data membership loss to update at least one weight of the adversary machine learning model.   
     
     
         9 . The method of  claim 8 , further comprising:
 selecting a first noise level for a first feature of the first training data item using the first privacy budget;   applying the first noise level to the first feature of the first training data item;   selecting a second noise level for a second feature of the first training data item using the second privacy budget; and   applying the second noise level to the second feature of the first training data item.   
     
     
         10 . The method of  claim 9 , further comprising generating a second transformed training data item from a second training data item of the plurality of training data items, the generating of the second transformed training data item comprising:
 applying the first noise level to a first feature of the second training data item; and   applying the second noise level to a second feature of the second training data item.   
     
     
         11 . The method of  claim 8 , further comprising:
 applying an encoder model to the first training data item to generate a first set of latent variable values, the first set of latent variable values comprising a first latent variable value and a second latent variable value;   selecting a first noise level for the first latent variable value using the first privacy budget;   applying the first noise level to first latent variable value;   selecting a second noise level for the second latent variable value using the second privacy budget;   applying the second noise level to second latent variable value; and   applying a decoder model to generate the first transformed training data item.   
     
     
         12 . The method of  claim 8 , further comprising applying a feature importance tool to the machine learning model to determine a first importance value for a first feature of the plurality of features and a second importance value for a second feature of the plurality of features. 
     
     
         13 . The method of  claim 12 , further comprising:
 accessing sensitivity data describing at least a first sensitivity level for the first feature and a second sensitivity value for the second feature; and   using the sensitivity data and the first importance value for the first feature to determine a modified first feature privacy budget.   
     
     
         14 . A non-transitory machine-readable medium comprising instructions thereon that, when executed by at least one processor, causes the at least one processor to perform operations comprising:
 accessing training data, the training data comprising a plurality of training data items, each of the plurality of training data items comprising a plurality of features;   from a first training data item of the plurality of training data items, generating a first transformed training data item using a first privacy budget corresponding to a first portion of the first training data item and a second privacy budget corresponding to a second portion of the first training data item;   training a machine learning model using the first transformed training data item to generate a trained machine learning model;   applying the trained machine learning model to the training data to generate at least one class probability for the plurality of training data items;   applying the trained machine learning model to test data comprising a plurality of test data items to generate at least one class probability for the plurality of test data items;   training an adversary machine learning model using training data, the at least one class probability for the plurality of training data items, the test data, and the at least one class probability for the plurality of test data items;   using the adversary machine learning model to determine a training data membership loss;   using the adversary machine learning model to determine a test data membership loss; and   using the training data membership loss and the test data membership loss to update at least one weight of the adversary machine learning model.   
     
     
         15 . The medium of  claim 14 , the operations further comprising:
 selecting a first noise level for a first feature of the first training data item using the first privacy budget;   applying the first noise level to the first feature of the first training data item;   selecting a second noise level for a second feature of the first training data item using the second privacy budget; and   applying the second noise level to the second feature of the first training data item.   
     
     
         16 . The medium of  claim 15 , the operations further comprising generating a second transformed training data item from a second training data item of the plurality of training data items, the generating of the second transformed training data item comprising:
 applying the first noise level to a first feature of the second training data item; and   applying the second noise level to a second feature of the second training data item.   
     
     
         17 . The medium of  claim 14 , the operations further comprising:
 applying an encoder model to the first training data item to generate a first set of latent variable values, the first set of latent variable values comprising a first latent variable value and a second latent variable value;   selecting a first noise level for the first latent variable value using the first privacy budget;   applying the first noise level to first latent variable value;   selecting a second noise level for the second latent variable value using the second privacy budget;   applying the second noise level to second latent variable value; and   applying a decoder model to generate the first transformed training data item.   
     
     
         18 . The medium of  claim 14 , the operations further comprising applying a feature importance tool to the machine learning model to determine a first importance value for a first feature of the plurality of features and a second importance value for a second feature of the plurality of features. 
     
     
         19 . The medium of  claim 18 , the operations further comprising:
 accessing sensitivity data describing at least a first sensitivity level for the first feature and a second sensitivity value for the second feature; and   using the sensitivity data and the first importance value for the first feature to determine a modified first feature privacy budget.   
     
     
         20 . The medium of  claim 18 , the operations further comprising:
 sending the first importance value for the first feature to a user computing device; and   receiving, from the user computing device, an indication of modified first feature privacy budget.